CVE-2024-45031

Apache Syncope is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to perform strict validation and sanitization of HTML tags. In the Syncope Console , incomplete HTML tags can be used to bypass sanitization, allowing attackers to inject payloads that trigger for other users. Addi...

CVE-2024-49340

IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to path traversal in onnx [CVE-2024-27318]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to path traversal in onnx, caused by improper validation of user requests CVE-2024-27318. Onyx is used by our Speech Service runtimes. This vulnerabilitiy has been addressed. Please read the details for...

CVE-2024-38503

Apache Syncope HTML-injection vulnerability (CVE-2024-38503) affects the Syncope Console and Enduser UI, where HTML tags can be injected into text fields during edits of users, groups, or other objects, potentially enabling exploits. The issue is documented across multiple sources (NVD, CNVD, Ver...

CVE-2024-1965

Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by oth...

UBUNTU-CVE-2023-52474

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix bugs with non-PAGESIZE-end multi-iovec user SDMA requests hfi1 user SDMA request processing has two bugs that can cause data corruption for user SDMA requests that have multiple payload iovecs where an iovec other th...

CVE-2022-3764

The plugin does not filter the "deleteentries" parameter from user requests, leading to an SQL Injection vulnerability...

Sql injection

The plugin does not filter the "deleteentries" parameter from user requests, leading to an SQL Injection vulnerability...

CVE-2022-3764 Form Vibes < 1.4.5 - Admin+ SQLi

The plugin does not filter the "deleteentries" parameter from user requests, leading to an SQL Injection vulnerability...

[SECURITY] Fedora 37 Update: rt-5.0.5-1.fc37

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitted by a community of users...

South River Technologies TitanFTP NextGen 安全漏洞

South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen versions prior to v2.0.1.2102, which originated fr...

CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service DoS condition...

CVE-2021-20126

Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request...

IBM Planning Analytics 跨站请求伪造漏洞

IBM Planning Analytics is a suite of business planning and analytics solutions from IBM USA. The solution supports automated execution of processes such as business planning, budgeting and analysis. IBM Planning Analytics suffers from a cross-site request forgery vulnerability that stems from...

Cross-Site Request Forgery (CSRF)

genix/cms is vulnerable to cross-site request forgery CSRF. An improper fix to a previous vulnerability CVE-2015-2680 allows an attacker with any valid anti-CSRF tokens to perform a CSRF attack on another user and submit requests on behalf of the user...

Authorization Bypass

ceph is vulnerable to authorization bypass attacks. The vulnerability exists as a flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, lumino...

Cisco Meeting Server Information Disclosure

The vulnerability of the Cisco Meeting Server platform arises from errors in processing user requests. Exploiting this vulnerability allows a malicious actor to gain access to protected information through specially crafted requests...

Directory traversal

A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management...

CVE-2018-8844

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request...

Mahara < 18.10.0 Mishandled User Requests Vulnerability

Mahara is prone to a vulnerability dealing with mishandled user requests. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...